How Nadir handles your data: the request path, what is stored and where, encryption and controls, subprocessors, and what Nadir does not have yet, like SOC 2.
Questions answered on this page
Does Nadir have SOC 2?
No. Nadir has no SOC 2 report and has not had an independent penetration test. Since September 27, 2026, Nadir has been listed in the CSA STAR Registry with a Level 1 self-assessment, which is self-attested rather than audited. For a security review, Nadir shares its architecture and data-flow document, information security policy, business continuity plan and completed CAIQ questionnaire on request.
Does Nadir store my prompts?
By default, yes. Nadir stores prompt and response content with each request so the dashboard and logs can show your traffic back to you. Turn prompt storage off in Settings and Nadir writes a SHA-256 hash in place of the prompt, drops the response, and keeps only metadata such as model, token counts, cost and latency. Deleting your account deletes the stored data.
Does Nadir train models on my prompts?
No. Customer prompts and completions are not used to train Nadir's routing models, which are trained on public benchmark data and Nadir's own internal data. The routing decision is computed by Nadir's own models inside its container. The optional third-party routing classifier listed in the Privacy Policy is currently turned off.
How does Nadir protect my model provider API keys?
Provider keys you bring are encrypted at the application layer with Fernet (AES-128-CBC with HMAC-SHA256) before they reach the database, with the encryption key held outside the database. A key is decrypted in memory only for the provider call and is never logged. Your Nadir API keys are generated in your browser and stored only as a SHA-256 hash, so the plaintext is shown once and never kept.
Where is my data stored?
In the United States. The database and authentication run on Supabase in AWS us-west-2, and the API runs on AWS App Runner in us-east-1. Prompts routed to a model provider are processed under that provider's terms, and under your own agreement with the provider when you use your own key.
Does Nadir support SSO or MFA for customer accounts?
Not on the hosted service today. Customers sign in with email and password, Google or GitHub. Inside Nadir, multi-factor authentication is required on every system that holds production access.